Practical cyber security guidance
How often should staff have cyber security training?
Cyber security training works best as an ongoing business process rather than a once-a-year compliance exercise. The right frequency depends on staff turnover, risk, roles, incidents and how quickly the threat or technology changes.
Frequently asked questions
6 practical answers.
### Is annual cyber security training enough?
Annual training can be a useful baseline, but many businesses benefit from shorter refreshers and timely updates during the year, particularly when threats, systems or business processes change.
### When should new employees be trained?
Give new starters practical security guidance as part of onboarding, including how to report suspicious messages, how authentication works, rules for devices and data, and any finance or payment-verification process.
### Should directors and managers receive different training?
Often yes. Leadership needs to understand incident decisions, business continuity, supplier risk, cyber insurance, regulatory exposure and ownership. Finance and administrators may need deeper training on impersonation and payment fraud.
### How often should phishing simulations be run?
There is no single correct interval. The programme should be frequent enough to identify trends and reinforce behaviour without turning into a punitive click-rate exercise. Results should lead to coaching and improved technical controls.
### Should training change after an incident?
Yes. Use real lessons from incidents and near misses to update examples, escalation routes and verification procedures. Avoid naming or blaming individual employees.
### What should good training cover?
Phishing, impersonation, payment fraud, passwords and MFA, Microsoft 365 risks, ransomware, safe device use, data handling, incident reporting and the practical steps staff should take when something feels wrong.
Related guidance